Detecting Distribution of Multimedia Content

ABSTRACT

A system and method is disclosed for detecting distribution of multimedia content. The volume level of data traffic is monitored for a plurality of users to select any users with high-bandwidth usage. The time of day and the day of the week may be considered when determining whether a user is a high-bandwidth user. Upon selecting a user as one with high-bandwidth usage, such user may be subject to packet inspections of data traffic streams. In some embodiments, content identification parameters or watermarks are added to one or more packets in a data traffic stream carrying multimedia content.

BACKGROUND

1. Field of the Disclosure

The present disclosure generally relates to content provider networksand more particularly to systems and methods for detectingredistribution of multimedia content.

2. Description of the Related Art

Multimedia content such as video-on-demand movies may be recorded byusers and then redistributed to others illegally or without theauthorization of the applicable owners of such content in violation ofcopyright laws.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a representative Internet Protocol Television (IPTV)system for implementing some disclosed embodiments;

FIG. 2 illustrates representative operations relating to an embodiedmethod; and

FIG. 3 depicts a data processing system in block diagram form that maybe incorporated into disclosed embodiments.

DESCRIPTION OF THE EMBODIMENT(S)

In one aspect, a method is disclosed for detecting distribution ofmultimedia content. The method comprises monitoring a volume of datatraffic for each of a plurality of users. Such monitoring results in avolume parameter for each of the plurality of users. The method furtherincludes selecting a portion of the plurality of users with volumeparameters that meet a predetermined condition. The method furthercomprises inspecting a data traffic stream for each of the selectedusers, wherein each traffic stream is searched for a contentidentification parameter.

In another aspect, a distribution detector application stored on acomputer readable medium is disclosed. The distribution detectorapplication has instructions operable for tracking a volume of datatraffic for a user. The distribution detector application further hasinstructions operable for comparing the volume of upstream traffic to athreshold volume. If the volume meets or exceeds the threshold volume,then further instructions are operable for analyzing an ordering historyof the user and comparing an estimated volume of traffic associated withthe ordering history to the volume of data traffic. If the volume ofdata traffic meets or exceeds the estimated volume of traffic associatedwith the ordering history, then further instructions are operable forcomparing an identification parameter associated with the volume oftraffic with one or more known identification parameters.

An additional disclosed system is for detecting distribution ofmultimedia content. The system comprises one or more data processingsystems configured to attach a content identification parameter to aportion of the multimedia content. The data processing systems arefurther configured to profile a plurality of users to identify a portionof the plurality of users with high bandwidth usage. The data processingsystems are further configured to track an ordering history parameterfor each of the portion of the plurality of users with high bandwidthusage to determine whether user has an order history parameter below athreshold. For any user with an order history parameter below athreshold, the data processing systems are further configured to inspectan upstream traffic stream from an appliance associated with the userfor the content identification parameter.

In the following description, for the purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the disclosed embodiments. A person of ordinary skillin the art should recognize that embodiments might be practiced withoutsome of these specific details. In other instances, well-knownstructures and devices may be shown in block diagram form or omitted forclarity.

Television programs, movies, radio programming and other multimediacontent may be distributed over telephone company networks,coaxial-based networks, satellite transmissions, WiFi transmission,WiMAX transmission, and the like. In some systems, for exampletraditional coaxial-based “cable” systems, a service provider maydistribute through the same coaxial or fiber-optic cable a compoundsignal containing a number of television channels at differentfrequencies. In conjunction, a set-top box or a tuner within atelevision, radio, recorder or similar device selects one or morechannels from the compound signal to play or record. In contrast to suchsystems that simultaneously distribute every available channel at alltimes, IPTV systems generally distribute content only in response touser requests. Such IPTV systems typically use Internet Protocol (IP)and other technologies found in computer networks. To provide IPTV, auser's telephone lines may, for example, be used in some combinationwith a residential gateway (RG), a digital subscriber line (DSL) modem,a set-top box (STB), a display, and other such equipment to receive andconvert into usable form the multimedia content provided from atelephone company network.

IPTV providers, satellite-based providers, digital cable providers, andother multimedia content providers may distribute multimedia contentusing bidirectional (i.e., two-way) communication between a user'scustomer premises equipment (CPE) and the service provider's equipment.Bidirectional communication allows a service provider to offer advancedfeatures, such as video-on-demand (VOD), pay-per-view, advancedprogramming information, text-based news, and the like.

Once multimedia content such as movies are distributed to a user's CPEsuch as a digital video recorder or personal computer, it may bepossible for the user to redistribute the multimedia content inviolation of copyright laws, for example. Although time-shiftingbenefits associated with recording multimedia content for personal useare generally well-recognized and accepted, redistribution ofcopyrighted material for display by other, unlicensed users may preventa content provider or other applicable entity from receiving owed feesand royalties. In order to detect the potential redistribution ofmultimedia content such as VOD movies, embodied systems and methodsprofile users by performing volume-level analysis. If a user orsubscriber has a particularly high level of upstream or downstreamtraffic flowing from or to his or her CPE, then the user may be flaggedas a potential distributor or recipient of bootlegged or unauthorizedmultimedia content. Distributing and receiving multimedia contentrequires high-bandwidth, and determining the amount of bandwidth used bya person and comparing it to the bandwidth used by others can help acontent provider to narrow the number of users that may receive furtherconsideration or analysis. After volume-level analysis, a profilingalgorithm may be implemented that tracks the viewing and orderinghistory of a user or subscriber. If a user or subscriber has ordered alarge number of VOD movies, then the user may be expected to have alarge amount of downstream traffic. If the user also has a large volumeof upstream traffic, then a content provider may consider the user orsubscriber as a potential distributor of multimedia content. Aftervolume-level analysis and profiling of ordering histories is completed,a matching algorithm may be performed to determine whether contentidentification parameters, fingerprints, watermarks, or other securityparameters are attached to or otherwise included within the videostreams sent or received from or to a user. Accordingly, disclosedembodiments are utilized for aiding in detecting the possibleredistribution of multimedia content such as VOD movies.

Content-level matching may occur based on wavelets. Video frames fromvideo servers may be analyzed by considering sequences of certain sizesstarting at specific sequence numbers. Wavelet transforms may beperformed of the sequences and a determination made of the coefficientsat different resolutions. The coefficients at different resolutions maybe stored. For outgoing streams from subscribers (i.e., upstreamtraffic) sequences of the same size may be considered and wavelettransforms performed to determine the coefficients. The coefficients maybe compared to determine whether a match occurs.

Content-level matching may be a resource-intensive operation.Volume-level pruning significantly reduces the set of subscribers thatare analyzed using content-level matching, which may examine the contentof packets or datagrams associated with a multimedia stream to determinewhether the content was previously tagged or appended with any securityfeatures. Subscriber content profiling further reduces the set of usersto compare for content-level matching.

Subscriber content profiling also may be used to narrow the field ofredistribution inquiries. With subscriber content profiling,redistribution detection efforts may be focused upon users that requestor distribute very popular or recent movies, for example. Accordingly,embodied systems may track distribution of popular multimedia contentacross all subscribers for a recent period (e.g., last week). This maybe done by tracking the ordering history of all subscribers, trackingchannel-changing, tracking VOD ordering history, and tracking on-demandcontent downloads for each individual subscriber for a recent period(e.g., last week). A content signature module operating within an IPTVdistribution system may be utilized to watermark popular content so thatpiracy detection efforts may be focused on popular content that is morelikely to be copied. In some embodiments, for any subscribers targetedby volume-level pruning, performing content-level matching may beperformed on multimedia content identified during subscriber contentprofiling. Embodied systems may be used by content providers to assistmovie studios, for example, to find probable unlawful distributors ofmultimedia content.

Referring now to the drawings, FIG. 1 illustrates selected aspects of anIPTV system 100 operated as part of a service provider network (e.g.,content provider network). Throughout this disclosure, a hyphenated formof a reference numeral refers to a specific instance of an element andthe un-hyphenated form of the reference numeral may refer to the elementgenerically or collectively. Thus, for example, reference numeral 124-1refers to an instance of an element 124. As shown in FIG. 1, IPTV system100 includes two set-top boxes (STBs) 124 including set-top box 124-1and set-top box 124-2. In the depicted embodiment, STB 124 communicatethrough access network 166 via modems 122 (i.e., modem 122-1 and modem122-2).

As shown, IPTV system 100 is configured to provide multimedia content tousers of set-top boxes 124 and includes a client-facing tier 102, anapplication tier 104, an acquisition tier 106, and an operations andmanagement tier 108. In addition, IPTV system 100 may provide multimediacontent to personal computer (PC) 168 and mobile device 169, which maybe a mobile telephone. Each tier 102, 104, 106 and 108 is coupled to aprivate network 110, to a public network 112 (e.g., the Internet), or toboth the private network 110 and the public network 112. Any of thevarious tiers coupled to the various networks may communicate with eachother over the networks. For example, as shown, the client-facing tier102 may communicate through the private network 110 with the acquisitiontier 106. Further, as shown, the application tier 104 may communicatethrough the private network 110 and the public network 112 with theacquisition tier 106. The interconnections between illustrated tiers andnetworks in FIG. 1 are meant as instructive and not limiting.

As shown, IPTV system 100 distributes multimedia content to users ofset-top boxes 124 for viewing on displays 126 and possibly for sendingto other components not shown, such as stereo equipment. In addition,users may attempt to illegally redistribute copyrighted multimediacontent to other users, which should be detected and prevented whenpossible. In order to distribute the multimedia content, IPTV system 100must first gain access to the multimedia content. To that end,acquisition tier 106 represents a variety of systems to acquiremultimedia content, reformat it when necessary, and prepare it fortransmission over private network 110 or public network 112. In itscapacity at acquiring and distributing multimedia for use on IPTV system100, acquisition tier 106 serves as a “content headend.” Acquisitiontier 106 may include, for example, systems for capturing analog and/ordigital content feeds, either directly from a content provider or from acontent aggregation facility. Content feeds transmitted via VHF/UHFbroadcast signals may be captured by broadcast server 156. Similarly,live acquisition server 154 may capture satellite signals, high-speedfiber feeds, or programming feeds sent over other suitable transmissionmeans. Content feeds to live acquisition server 154 may includebroadcasted multimedia content, for example premium audio/videoprogramming (i.e., traditional “cable channels”) widely available butnot typically broadcast over airwaves. Acquisition tier 106 may furtherinclude signal conditioning systems and content preparation systems forencoding content. As shown, acquisition tier 106 includes VOD importerserver 158 and may include a digital rights management (DRM) server forencrypting content (not shown). VOD importer server 158 receives contentfrom one or more VOD sources that may be outside the IPTV system 100,for example discs or transmitted feeds. VOD importer server 158 maytemporarily store multimedia content for transmission to a VOD server136 on client-facing tier 102. In addition, the VOD content may bestored at one or more servers, such as the VOD server 136. The storedVOD content may be distributed by multicast (i.e., a single stream sentsimultaneously to multiple viewers) or by unicast (i.e., a single streamsent to individual users) in a VOD system.

After acquiring the multimedia content, IPTV system 100 distributes thecontent over private network 110, for example. Private network 110 maybe referred to as a “core network.” In some embodiments, private network110 consists of a fiber backbone (i.e., WAN) and one or more video huboffices (VHOs). Generally, private network 110 transports multimediacontent (e.g., video, music, Web pages, channel lineups, and data) fromthe acquisition tier 106 to set-top boxes 124 through access network 166(via client-facing tier (CFT) switch 130). In this role, private network110 serves as the “backbone” for IPTV system 100. In a large deploymentof IPTV system 100 that covers a vast geographic region, private network110 may represent several smaller networks that each may only transfercontent within a subset of the region. Accordingly, private network 110may provide for the insertion of local content that is relevant only toa subset region. For example, private network 110 may allow for thelocalized insertion of local advertisements or local emergency alertsystems for a particular service area.

To illustrate the distribution of multimedia content acquired byacquisition tier 106, in an example embodiment, broadcast server 156acquires broadcast multimedia content and communicates it to liveacquisition server 154. Live acquisition server 154 transmits themultimedia content to the AcQuisition Tier (AQT) switch 152. In turn,the AQT switch 152 transmits the multimedia content to the CFT switch130, for example, via the private network 110. As shown, the CFT switch130 may communicate the multimedia content through modems 122 via theaccess network 166. In some embodiments, STBs 124 receive the multimediacontent via modems 122 and transmit it to displays 126.

In some embodiments, live acquisition server 154 and VOD importer server158 take numerous data streams and encode them into a digital videoformat, such as MPEG-2, or MPEG-4. After encoding, data streams may beencapsulated into IP data streams and transmitted to specific IPdestinations (e.g., STBs 124) in response to a user's request for aparticular channel, for example. Video content server 180, VOD server136, or image/data server 132 may act as an intermediary or repositoryfor multimedia content obtained and encoded by acquisition tier 106. Insome embodiments, multimedia content is transmitted to the video contentserver 180, where it is encoded, formatted, stored, or otherwisemanipulated and prepared for communication to the STB 124.

As shown, IPTV system 100 includes access network 166. Access network166 provides a network link from the private network 110 to each user'slocation. To this end, access network 166 provides a network translationas necessary from a switched network, for example, to the accesstechnology used to transmit data and multimedia content to theconsumer's location. For example, a service provider that usestwisted-pair telephone lines to deliver multimedia content to consumersmay utilize digital subscriber lines within access network 166. Thedigital subscriber lines may utilize some combination of DSL, DSL2,DSL2+, ADSL, VDSL or other technologies. In some embodiments, accessnetwork 166 may use fiber-to-the-home (FTTH). In such cases, opticalfiber may be used all the way to the consumer's location to providehigh-bandwidth. In other embodiments, fiber-to-the-curb (FTTC)deployments are used to deliver multimedia content to consumers. In suchcases, a digital subscriber line access multiplexer (DSLAM) may be usedwithin access network 166 to transfer signals containing multimediacontent from optical fiber to copper wire for DSL delivery to consumers.In other embodiments, access network 166 may use radio frequency (RF)signals sent over coaxial cables. Accordingly, access network 166 mayutilize quadrature amplitude modulation (QAM) equipment for downstreamtraffic. In these systems, access network 166 may receive upstreamtraffic from a consumer's location using quadrature phase shift keying(QPSK) modulated RF signals. In such systems, a cable modem terminationsystem (CMTS) may be used to mediate between IP-based traffic on privatenetwork 110 and access network 166.

In operation, if a user requests VOD content via a STB 124, the requestmay be transmitted over the access network 166 to VOD server 136, viathe CFT switch 130. Upon receiving the request, the VOD server 136retrieves or accesses the requested VOD content and transmits thecontent to the STB 124 across access network 166 via CFT switch 130. Inturn, STB 124 transmits relevant video portions of the VOD content tothe display 126. STB 124 may transmit audio portions of the VOD contentto a stereo system (not shown) or may allow (or disallow) sending theVOD content to a recording device (not shown).

As shown, IPTV system 100 includes application tier 104. Applicationtier 104 communicates with acquisition tier 106 and client-facing tier102 through private network 110. Application tier 104 may communicatethrough various communication protocols including hypertext transferprotocol (HTTP). Generally, application tier 104 may includenotification servers, billing servers, and any of a variety ofsubscriber application servers employed by an owner or operator (i.e.,network service provider) of IPTV system 100. In some embodiments,elements of the application tier 104 such as client gateway 150communicate directly with the client-facing tier 102. The components ofclient-facing tier 102 may communicate using HTTP, transmission controlprotocol (TCP) or datagram protocol (UDP), as examples.

The TCP/IP protocol suite may be used to form frames or packets thatmake up a distributed multimedia stream. Upon the formation of frames orpackets, a transport layer header which may be a TCP or UDP is typicallyappended to each frame or packet. The transport layer in the TCP/IPprotocol stack is responsible for the delivery of packets. In manycases, a header includes a destination port field with a numeric entrythat defines the data being transported. Data (e.g., multimedia content)may be encapsulated with a transport header that identifies the data(e.g., multimedia content). Once encapsulated, a TCP segment or UDPdatagram may be passed to the network layer. Some disclosed embodimentsattached a signature, content identification parameter, watermark orother security parameter to a header during encapsulation. Such securityparameters may include a recipient identification parameter related tothe person, computer, or account to which the content is originallysent. This helps in tracking the content upon possible redistribution.Recipient identification parameters may include computer serial numbers,consumer credit card numbers, or network interface card IP addresses. Insome embodiments, security features that aid in tracking are embedded inthe content of packets or files to make tracking and removing of thesecurity features more difficult. [0026] If the multimedia content isaudio content, sequences of frames may be analyzed to determine whethera stream contains a particular song, for example. A frame may consist ofa group of audio samples that are processed together to determine afrequency spectrum. The frequency spectrums may be compared and analyzedagainst samples of known songs to determine whether any known songs arebeing sent within a file stream. [0027] Referring again to FIG. 1, theclient-facing tier 102 is coupled for communication with user equipment(e.g., modems 122) via access network 166. Access network 166 may bereferred to as the “last mile” for a service provider or networkoperator. It provides network connectivity of IPTV services toconsumers' locations. Client-facing tier 102 may be required tomulticast multimedia content to multiple destinations. For example, thesame multimedia content may be distributed substantially simultaneouslyto STB 124-1 and STB 124-2. In contrast to a multicast or a unicast,some embodiments “broadcast” programming or data to all users on anetwork as a “broadcast” transmission. For example, a TV guide featurefor displaying available programming may be broadcast to every user.

To deliver multimedia content, client-facing tier 102 may employ anycurrent or future Internet protocols for providing reliable real-timestreaming multimedia content. In addition to the TCP, UDP, and HTTPprotocols discussed above, such protocols may use, in variouscombinations, other protocols including, file transfer protocol (FTP),real-time transport protocol (RTP), real-time control protocol (RTCP),and real-time streaming protocol (RTSP), as examples. In someembodiments, client-facing tier 102 sends multimedia contentencapsulated into IP packets over access network 166. For example, anMPEG-2 transport stream may be sent, in which the transport streamconsists of a series of 188-byte transport packets. To ensure quality ofservice, protocols should be chosen that minimize dropped packets,jitter, delay, data corruption, and other errors.

As shown, the client-facing tier 102 may communicate with a large numberof set-top boxes, such as representative STBs 124, over a wide area,which may be for example, a regional area, a metropolitan area, aviewing area, a designated market area, or any other suitable geographicarea, market area, or user group supported by networking theclient-facing tier 102 to numerous set-top boxes. In an illustrativeembodiment, the client-facing tier 102, or any portion thereof, may beincluded at a video headend office (not depicted).

In some embodiments, the client-facing tier 102 may be coupled to modems122 via fiber optic cables. Alternatively, modems 122 may be DSL modemscoupled to one or more network nodes via twisted pairs. Each STB 124 mayprocess data received over the access network 166 via various IPTVsoftware platforms that are commonly known.

In an illustrative embodiment, the client-facing tier 102 includes a CFTswitch 130 that manages communication between the client-facing tier 102and the access network 166. CFT switch 130 also manages communicationbetween the client-facing tier 102 and the private network 110 and iscoupled to an image/data server 132 that may store streaming multimediacontent and possibly still images associated with programs of variousIPTV channels. Image/data server 132 stores data related to variouschannels, for example, types of data related to the channels and toprograms or video content displayed via the channels. In an illustrativeembodiment, image/data server 132 may be a cluster of servers, each ofwhich may store streaming multimedia content, still images, channel andprogram-related data, or any combination thereof CFT switch 130 may alsobe coupled to terminal server 134 that provides terminal devices with aconnection point to the private network 110. As shown, CFT switch 130may also be coupled to VOD server 136 that stores or provides VODcontent imported by the IPTV system 100. As shown, the client-facingtier 102 also includes video content server 180 that transmits videocontent requested by viewers to STBs 124. In some embodiments, videocontent server 180 includes one or more multicast servers.

As illustrated in FIG. 1, application tier 104 may communicate withnumerous components through private network 110 and public network 112.As shown, application tier 104 includes a first application tier (APP)switch 138 and a second APP switch 140. The first APP switch 138 iscoupled to the second APP switch 140 and a combinationoperation-systems-support (OSS) and billing-systems-support (BSS)gateway 144 (i.e., OSS/BSS gateway 144). In some embodiments, theOSS/BSS gateway 144 controls access to an OSS/BSS server 164 that storesoperations and billing systems data.

As shown, application tier 104 includes application server 142.Application server 142 may be any data processing system with associatedsoftware that provides information services (i.e., applications) forclients or users. Application server 142 may be optimized to provideservices including conferencing, voicemail, and unified messaging. Insome embodiments, services include electronic programming guides (EPG),conditional access systems (CAS), DRM servers, a navigation/middlewareserver, and IPTV portal, e-mail services, and remote diagnostics.

Packet Switched Public Data Networks (PSPDN) are public data networksthat interconnect data processing systems (e.g., computers) with eachother to provide accessibility and exchange of data including multimediacontent. The Internet is an example of a public data network that usesIP for transporting data including multimedia content from one dataprocessing system to another data processing system using data packets.Data packets transmitted over the Internet find their way throughnetwork switching nodes (e.g., computers) that forward received packetsto other data processing systems and nodes until a packet reaches itsdestination data processing system. Each node may contain routing tablesto provide packet forwarding information.

Multimedia content may be digitized and transferred using packets, whichare small groups of digital bits that are routed through a network to adestination STB, computer, or other similar data processing system.Packets may be transmitted through a packet buffer, which may containmemory spaces for storing packets that are awaiting transmission. Packetbuffers may also be used for storing a received packet. The memory usedfor packet buffers may be located in a network interface controller, arouter, or other data processing system. Packet buffering may be used toreduce the effects of packet delays and packet loss when streamingmultimedia content. In accordance with disclosed embodiments, videocontent and other multimedia content may be stored in one or more packetbuffers for later (i.e., not real-time) content analysis to detectillegal distribution.

Packet encapsulation relates to inserting the contents of a data packetinto the data portion (i.e., payload) of another packet. In accordancewith disclosed embodiments, signatures, identification parameters,watermarks or other security identifiers may be placed in a packetheader during packet encapsulation. Packet filters may also be used toinspect packets or alter the content of packets during encapsulation. Inaddition, a packet header may be altered to add security identifiers,for example.

A packet assembler and disassembler (PAD) may be any packet data systemthat converts data files to and from packets of digital information. Alarge file may be sent over a packet data network by supplying the fileto a PAD circuit that divides the data file into smaller packets thatare sent towards a destination data processing system through a datanetwork. Packet data systems may use an address (e.g., IP address)contained in the header of each packet to dynamically route thesepackets through a switching network to their ultimate destination. Whenthe packets are received, they may be reassembled into the originallarge data file by a packet assembler. In accordance with disclosedembodiments, during conversion of a data file into packets (i.e., duringpacket assembly), watermarks or security identifiers may be placed in aheader or within each packet to allow for identifying the packets incase they are later distributed. Accordingly, disclosed embodiments mayoperate by placing a watermark on packets that transport multimediacontent. Watermarking is a process of embedding or adding information toa file or packet. Watermarking may be used to identify the media asauthentic or to provide a means for tracking the identity of a packet aspart of a protected file. A watermark may be any imperceptible signalhidden in another signal, such as a multimedia content stream, thatcarries data or information. To enhance security, watermarks arepreferably imperceptible by programs intended to overcome watermarkingprotection by destroying watermarks. A watermark extractor is a filterthat may be a software program that is enabled for separating awatermark from a file or packet. In some cases, watermarks may be usedto provide a key that is needed to decode and/or play a file.

As shown in FIG. 1, second APP switch 140 is communicatively coupled toa domain controller 146 that provides web access, for example, to usersvia public network 112. Second APP switch 140 is communicatively coupledto subscriber and system store 148 that includes account information,such as account information that is associated with users who access theIPTV system 100 via private network 110 or public network 112.Therefore, for example, a user may employ PC 168 to receive IPTV accountinformation via public network 112. Similarly, a user may employ mobiledevice 169 or another similar multifunction device over private network110 or public network 112 to receive information through second APPswitch 140. In some embodiments, application tier 104 may also includeclient gateway 150 that communicates data directly with client-facingtier 102. In these embodiments, client gateway 150 may be coupleddirectly to the CFT switch 130. Accordingly, client gateway 150 mayprovide user access to private network 110 and tiers coupled thereto.

In some embodiments, STB 124 accesses IPTV system 100 via access network166, using information received from client gateway 150. In suchembodiments, access network 166 may provide security for private network110. Therefore, user devices may access client gateway 150 via accessnetwork 166, and client gateway 150 may allow such devices to accessprivate network 110 once the devices are authenticated or verified.Similarly, client gateway 150 may prevent unauthorized devices, such ashacker computers or stolen STBs, from accessing private network 110, bydenying access to these devices beyond the access network 166.

Accordingly, in some embodiments, when a STB 124 accesses the IPTVsystem 100 via the access network 166, the client gateway 150 verifiesuser information by communicating with the subscriber/system store 148via the private network 110, the first APP switch 138, and the secondAPP switch 140. The client gateway 150 verifies billing information anduser status by communicating with the OSS/BSS gateway 144 via theprivate network 110 and the first APP switch 138. The OSS/BSS gateway144 may transmit a query across the first APP switch 138, to the secondAPP switch 140, and the second APP switch 140 may communicate the queryacross the public network 112 to the OSS/BSS server 164. Upon the clientgateway 150 confirming user and/or billing information, the clientgateway 150 allows the STB 124 access to IPTV content, VOD content, andother services. If the client gateway 150 cannot verify user informationfor the STB 124, for example, because it is connected to an unauthorizedtwisted pair or residential gateway, the client gateway 150 may blocktransmissions to and from the STB 124 beyond the access network 166.

STBs 124 convert digital compressed signals into a format suitable fordisplay. STBs 124 have functionality for recognizing and acting on IPpackets, for example UDPs transmitted within IP datagrams. STBs 124 maycontain software or firmware coding for sending requests to applicationserver 142, for example, to receive requested programming or data. Insome embodiments, requests for content (e.g., VOD content) flow througha billing or management server to verify that a user is not in arrearsregarding payment. In some embodiments, STB 124 supports Web browsing onthe Internet (e.g., public network 112) and may support cycling throughguide data, for example, using Web services. Each STB 124 may be enabledfor viewing e-mail, viewing e-mail attachments, and interfacing withvarious types of home networks.

In accordance with disclosed embodiments, each STB 124 may be a cablebox, a satellite box, or an electronic programming guide box. Further,although shown separately, STBs 124 may be incorporated into anymultifunctional device such as, a television, a videocassette recorder,a digital video recorder, a computer, a personal computer media player,or other media device. Generally, STBs 124 each represent a dedicateddata processing system (e.g., computer) that provides an interfacebetween a display and a service provider. As shown, STBs 124 areconnected to the service provider through modems 122. Although modems122 are shown in FIG. 1, other residential gateways may be employed.Alternatively, STBs 124 may be connected directly to access network 166.

STBs 124 contain software or firmware instructions stored in memories172 or other storage for receiving and processing input from remotecontrols 120. In some embodiments, STBs 124 are IP based set-top boxesand have capability for outputting resultant multimedia signals (e.g.,streaming audio/video) in various formats including S-video, compositevideo, high definition component video, high definition multimediainterface (HTMI), and video graphics array (VGA) signals. The resultantmultimedia signals may support displays 126 that have various videomodes including analog NTSC, 1080 i, 1080 p, 480 i, 480 p, 720 p, asexamples. In some embodiments, STBs 124 communicate with modems 122 overlocal area networks (LANs) connected using CAT5 cables, CAT6 cables,wireless interfaces, or a Home Phoneline Networking Alliance (HPNA)network, as examples.

As shown STBs 124 are coupled to displays 126. Each display 126 mayinclude a cathode ray tube (CRT), television, monitor, projected image,liquid crystal display (LCD) screen, holograph, or other graphicalequipment. STBs 124 communicate with remote controls 120. STBs 124 mayinclude wireless transceivers 129 to communicate with wirelesstransceivers (not shown) of remote controls 120. Remote controls 120 maybe used in conjunction with STBs 124 to operate graphical userinterfaces (GUIs) displayed on displays 126.

STBs 124 may receive multimedia data including video content and audiocontent from the client-facing tier 102 via the access network 166. Themultimedia content may be associated with a broadcast program thatincludes streaming multimedia content. The multimedia content mayinclude VOD presentations and pay-per-view sporting events. A contentprovider may wish to detect any redistribution of the VOD presentationsand pay-per-view sporting events, in accordance with disclosedembodiments. The multimedia content may also include pod casts, webcasts, or audio files used for playing on portable audio devices, asexamples. As it receives data that includes the multimedia content, STB124 may store the content or may format the content into a resultantmultimedia signal for sending to displays 126 and other equipment (notshown) for producing portions of the multimedia content in usable form.

As shown, each STB 124 includes an STB processor 170 and an STB memory172 that is accessible by STB processor 170. An STB computer program(STB CP) 174, as shown, is embedded within each STB memory 172. Asshown, memories 172 are coupled with databases 186 that each includedata 187. In addition to or in conjunction with STB componentsillustrated in FIG. 1, STBs 124 may contain modules for transport,de-multiplexing, audio/video encoding and decoding, audio digital toanalog converting, and radio frequency (RF) modulation. For clarity,such details for these modules are not shown in FIG. 1. In addition,details are not provided for allowing STBs 124 to communicate throughaccess network 166 through modems 122. However, such communications canbe carried out with known protocols and systems for network interfacingsuch as conventional network interface cards (NICs) used in personalcomputer platforms. For example, STB 124 may use a network interfacethat implements level 1 (physical) and level 2 (data link) layers of astandard communication protocol stack by enabling access to a twistedpair or other form of physical network medium and supporting low leveladdressing using media access control (MAC) addressing. In theseembodiments, STBs 124 may each have a network interface including aglobally unique 48-bit MAC address stored in a ROM or other persistentstorage element. Similarly, each modem 122 (or other RG) may have anetwork interface (not depicted) with its own globally unique MACaddress. Further, although STBs 124 are depicted with various functionsin separate components, these components may be implemented with asystem on chip (SoC) device that integrates two or more components.

As shown, STBs 124 may also include a video content storage module, suchas a digital video recorder (DVR) 176. In a particular embodiment, STBs124 may communicate commands received from the remote controls 120 tothe client-facing tier 102 via the access network 166. Commands receivedfrom the remote controls 120 may be entered via buttons 121.

IPTV system 100 includes an operations and management tier 108 that hasan operations and management tier (OMT) switch 160. OMT switch 160conducts communication between the operations and management tier 108and the public network 112. The OMT switch 160 is coupled to a TV2server 162. Additionally, the OMT switch 160 as shown is coupled to anOSS/BSS server 164 and to a simple network management protocol (SNMP)monitor server 178 that monitors network devices within or coupled tothe IPTV system 100. In some embodiments, the OMT switch 160communicates with the AQT switch 152 via the public network 112.

In an illustrative embodiment, the live acquisition server 154 transmitsthe multimedia content to the AQT switch 152, and the AQT switch 152, inturn, transmits the multimedia content to the OMT switch 160 via thepublic network 112. In turn, the OMT switch 160 transmits the multimediacontent to the TV2 server 162 for display to users accessing the userinterface at the TV2 server 162. For example, a user may access the TV2server 162 using a PC 168 coupled to the public network 112.

An IPTV system may contain elements such as a video headend, serviceprovider IP network, service provider access network, and the home orresidence network. If a consumer or user is downloading a movie or musicvideo, for example, using the public Internet, a video headend mayrepresent one enterprise or company and the service provider IP networkmay represent a series of IP networks interconnected at a peering pointto form the Internet backbone. A service provider access network mayrepresent an Internet service provider (ISP) and the home network mayconsist of a router and wireless LAN products that may be obtained fromone or more manufacturers. In comparison, if the consumer accesses amovie or television show via a private IP network, the video headend,service provider IP network, and service provider access network may beprovided by a single enterprise or company. Indeed, a single enterpriseor company may provide end-to-end service including any required homenetworking equipment. Accordingly, embodied systems may be operatedwithin and in conjunction with various components within an IPTVnetwork. Further, the disclosed embodiments are meant as illustrativeand not limiting.

FIG. 2 illustrates in block diagram form a methodology 200 for detectingredistribution of multimedia content. In operation 201, data trafficvolume for a plurality of users is monitored. Volume level monitoring isperformed by analyzing the number of packets sent upstream from a user'sCPE, for example. A residential gateway, STB, or client application on adata processing system may be configured to monitor traffic levels andreport to a distribution detector (e.g., distribution detector 131 inFIG. 1). In other embodiments appliances may intercept or snoop trafficflowing through a switch, for example, to detect or estimate the amountof traffic (i.e., bandwidth usage) that is associated with a user. Bothdownstream traffic and upstream traffic may be monitored. If upstreamtraffic is very high and downstream traffic is relatively low, then asystem may target a person for another level of investigation by aredistribution detection system. Accordingly, volume-level analysis maybe performed as a preliminary matter to detect possible redistributorsof multimedia content. This volume-level analysis is conducted under thetheory that a user having high-bandwidth usage is more likely to beredistributing multimedia content illegally than a user withlow-bandwidth usage. Further, a user with high-bandwidth usage may be arepeat offender that might naturally be a first target of aninvestigation for detecting redistribution of multimedia content.

As shown in operation 203, a portion of monitored users that meet apredetermined condition or conditions is selected. In some embodiments,a volume of traffic for a plurality of users is monitored and for allusers or for a portion of the plurality of users a volume parameter isranked against other users. Users with high volume parameters or highbandwidth usage may be selected for further examination. The time of daymay be considered in determining a user's volume parameter orparameters, and if a user has a high volume of upstream traffic whenmost other users have low volumes of traffic, the user may be flaggedfor further examination. An example predetermined condition forselection in operation 203 is ranking in the top 95^(th) percentilecompared to other users with regard to upstream bandwidth traffic. Theratio of upstream traffic to downstream traffic may also be analyzed forconducting operation 203. Since volume level analysis may be processoror resource intensive, the amount of resources available for analysismay be considered when configuring a system to conduct volume-levelanalysis within a content provider network.

As shown in operation 205, for users selected in operation 203 based onvolume-level analysis, content inspection of data traffic may beperformed to determine whether data traffic includes illegallyredistributed multimedia content. In some embodiments, a securityparameter such as a watermark may be appended to packets that make updistributed content that is the subject of monitoring according todisclosed embodiments. A content signature module (e.g., contentsignature module 133 in FIG. 1) may be enabled for creating andattaching identification parameters, security identifiers, watermarks,and the like to one or more packets, frames, or datagrams (e.g., UDPdatagrams) associated with tracked content. Popular movies-on-demand orpay-per-view sporting events may be targeted for marking and detectionin accordance with operation 205. Channel changing parameters andratings based systems may be used in determining multimedia content formarking and possible detection. In some embodiments, multimedia contentmay be marked when it is sent to a particular user who has been flaggedin operation 203 as a potential redistributor of multimedia content.Multimedia content sent to the flagged user may contain a uniqueidentifier or security feature to enable later tracking of themultimedia content if it is redistributed repeatedly.

In operation 207, an optional operation is performed for recordingparameters regarding the frequency with which a user orders multimediacontent. For example, if a user infrequently orders pay-per-view moviesbut often sends large volumes of traffic upstream, the user may betargeted as a redistributor of multimedia content. Operation 207 mayoptionally be performed before operation 205 or before operation 203 asa further factor in the selection process for users in need of analysisunder operation 205. In this way, disclosed embodiments provide methodsand systems for detecting distribution of multimedia content.

FIG. 3 is a diagrammatic representation of a machine (i.e., dataprocessing system) in the example form of a computer system 300 withinwhich a set of instructions for causing the machine to perform any oneor more of the methodologies discussed herein, may be executed. Inalternative embodiments, the machine operates as a standalone device ormay be connected (e.g., networked) to other machines. In a networkeddeployment, the machine may operate in the capacity of a server or aclient machine in a server-client network environment, or as a peermachine in a peer-to-peer (or distributed) network environment. Themachine may be a DVR, a PC, a tablet PC, STB, a cable box, a satellitebox, an electronic programming guide box, a Personal Digital Assistant(PDA), RG, a cellular telephone, a web appliance, a network router,switch or bridge, or any machine capable of executing a set ofinstructions (sequential or otherwise) that specify actions to be takenby that machine. Further, while only a single machine is illustrated,the term “machine” shall also be taken to include any collection ofmachines that individually or jointly execute a set (or multiple sets)of instructions to perform any one or more of the methodologiesdiscussed herein.

The example computer system 300 includes a processor 302 (e.g., acentral processing unit (CPU), a graphics processing unit (GPU) orboth), a main memory 304 and a static memory 306, which communicate witheach other via a bus 308. The main memory 304 and/or the static memory306 may be used to store the channel history data. The computer system300 may further include a video display unit 310 (e.g., a television, aLCD or a CRT) on which to display broadcast or other programs, forexample. The computer system 300 also includes an alphanumeric inputdevice 312 (e.g., a keyboard or a remote control), a user interface (UI)navigation device 314 (e.g., a remote control, or a mouse), a disk driveunit 316, a signal generation device 318 (e.g., a speaker) and a networkinterface device 320. The alphanumeric input device 312 and/or the UInavigation device 314 (e.g., the remote control) may include a processor(not shown), and a memory (not shown). The disk drive unit 316 includesa machine-readable medium 322 on which is stored one or more sets ofinstructions and data structures (e.g., software 324) embodying orutilized by any one or more of the methodologies or functions describedherein (e.g., the software to access the channel history data in thedatabase 186). The software 324 may also reside, completely or at leastpartially, within the main memory 304 and/or within the processor 302during execution thereof by the computer system 300.

The software 324 may further be transmitted or received over a network326 (e.g., a television cable provider) via the network interface device320 utilizing any one of a number of well-known transfer protocols(e.g., broadcast transmissions, HTTP). While the machine-readable medium322 is shown in an example embodiment to be a single medium, the term“machine-readable medium” should be taken to include a single medium ormultiple media (e.g., a centralized or distributed database, and/orassociated caches and servers) that store the one or more sets ofinstructions. The term “machine-readable medium” shall also be taken toinclude any medium that is capable of storing, encoding or carrying aset of instructions for execution by the machine and that cause themachine to perform any one or more of the methodologies of the presentinvention, or that is capable of storing, encoding or carrying datastructures utilized by or associated with such a set of instructions.The term “machine-readable medium” shall accordingly be taken toinclude, but not be limited to, solid-state memories, optical andmagnetic media, and carrier wave signals. Disclosed embodiments areintended to detect illegal multimedia content redistribution that mayoccur in violation of copyright laws, for example. A content providermay have a large number of subscribers or users and detecting illegal orunauthorized distribution is a resource consuming process. Therefore,steps may be taken to increase the likelihood of detecting illegaldistribution while minimizing the number of resources used. To this end,disclosed embodiments conduct volume-level pruning to narrow the pool ofpotential bad actors to a subset of the total number of subscribers orusers. The volume-level pruning may be based on either upstreambandwidth usage, downstream bandwidth usage, or both.

Using disclosed embodiments, trends of upstream bandwidth usage by aparticular user may be compared to other users. If a particular user'supstream bandwidth is significantly higher than other users' bandwidthusage, then the user may be flagged as a high-bandwidth user. Inaddition to detecting raw volume, disclosed embodiments may consider thetime of day of the high-bandwidth usage. For example, if high-bandwidthusage occurs at a time when most people sleep (e.g., 3:00 a.m.), thecontent provider may also flag the user since it may be more likely thatthe user is downloading or uploading content for illegal purposes.Averaged upstream bandwidth usage may also be monitored by the day ofthe week and compared to other users. The subscriber's upstreambandwidth usage can be compared to other subscribers, and if the averageupstream bandwidth usage of a subscriber is much higher than that of allother subscribers, or the average upstream bandwidth usage by day ofweek and time of day differs significantly from that of all othersubscribers, the subscriber may be targeted for another layer ofanalysis such as content-level matching.

The specification and drawings are to be regarded in an illustrativerather than a restrictive sense. It should be evident that variousmodifications and changes may be made to disclosed embodiments withoutdeparting from the broader spirit and scope of the claimed subjectmatter.

1. A method of detecting distribution of multimedia content, the methodcomprising: monitoring a volume of data traffic for each of a pluralityof users resulting in a volume parameter for each of the plurality ofusers; selecting a portion of the plurality of users with volumeparameters that meet a predetermined condition; and inspecting a datatraffic stream for each of the portion of selected users, wherein eachtraffic stream is searched for a content identification parameter. 2.The method of claim 1, wherein the data traffic includes upstreamtraffic.
 3. The method of claim 2, wherein the data traffic includesdownstream traffic.
 4. The method of claim 1, further comprising:recording a video-on-demand parameter for individual users of theportion of selected users, wherein the video-on-demand parameter relatesto a quantity of video-on-demand movies ordered by one of the individualusers.
 5. The method of claim 1, wherein the content identificationparameter is a watermark, wherein inspecting the data traffic streamincludes comparing the watermark associated with one or more packets inthe data traffic with a known watermark.
 6. The method of claim 1,wherein inspecting the data traffic occurs substantially in real-time.7. The method of claim 1, wherein a plurality of packets from each datatraffic stream are stored in a memory, and wherein inspecting theplurality of packets occurs not in real-time.
 8. The method of claim 3,wherein a network receives a volume parameter of the data traffic froman apparatus that is customer premises equipment.
 9. The method of claim1, wherein selecting the portion of the plurality of users includesdetecting one or more of the plurality of users with relatively hightraffic volumes during a non-peak time slot compared to others of theplurality of users.
 10. A data distribution detector application storedon a computer readable medium, the distribution detector applicationhaving instructions operable for: tracking a volume of upstream datatraffic for a user; comparing the volume of upstream data traffic to athreshold volume; if the volume meets or exceeds the threshold volume,then: analyzing an ordering history of the user; and comparing anestimated volume of traffic associated with the ordering history to thevolume of data traffic; and if the volume of data traffic meets orexceeds the estimated volume of traffic associated with the orderinghistory, then: comparing an identification parameter associated with thevolume of traffic with one or more known identification parameters. 11.The data distribution detector application of claim 10, further havinginstructions operable for: accessing a content signature module, whereinthe content signature module stores the one or more known identificationparameters.
 12. The data distribution detector application of claim 11,wherein the distribution detector application is communicatively coupledto a client-facing tier switch.
 13. The data distribution detectorapplication of claim 12, wherein a residential gateway tracks the volumeof data traffic for the user and reports the volume of data traffic tothe distribution detector application.
 14. The data distributiondetector application of claim 11, wherein the content signature moduleprovides for assigning the one or more known identification parameters.15. The data distribution detector application of claim 14, wherein theidentification parameter is a watermark.
 16. The data distributiondetector application of claim 10, wherein comparing an estimated volumeof traffic associated with the ordering history to the volume of datatraffic includes analyzing a video-on-demand ordering history.
 17. Thedata distribution detector application of claim 10, wherein tracking avolume of data traffic for a user includes considering a time of dayassociated with data traffic.
 18. The data distribution detectorapplication of claim 10, further including: a set-top box for tracking asecond volume of downstream traffic.
 19. A data processing system fordetecting distribution of multimedia content, the data processing systemhaving software instructions stored on a computer readable medium thatenable the data processing system to: attach a content identificationparameter to a portion of the multimedia content; profile a plurality ofusers to identify a portion of the plurality of users with highbandwidth usage; track an ordering history parameter for each of theportion of the plurality of users with high bandwidth usage to determinewhether any has an order history parameter below a threshold; and forany user with an order history parameter below the threshold, inspect anupstream traffic stream from an appliance associated with the user forthe content identification parameter.
 20. The data processing system ofclaim 19, wherein inspecting the upstream traffic for the contentidentification includes storing a portion of the upstream traffic streamfor non-real-time analysis.
 21. The data processing system of claim 19,wherein tracking an ordering history parameter for each of the portionof the plurality of users includes characterizing a number ofvideo-on-demand movies ordered by each of the portion of the pluralityof users.
 22. The data processing system of claim 19, wherein attachinga content identification parameter to a portion of the multimediacontent includes placing a security identifier in one or more packetsthat comprise the multimedia content.
 23. The data processing system ofclaim 22, wherein the one or more data processing systems are furtherconfigured to: create the security identifier for placement in one ormore packets that comprise the multimedia content.
 24. The dataprocessing system of claim 23, wherein the one or more packets aredatagram protocol (UDP) datagrams.